Target IP: 192.168.155.209
The war wages onward
Tags: SQL Injection, Password Bruteforcing, LFI.
Scanning & Enumeration
I forgot to take a screenshot of the nmap scans. But there is a filtered SSH port, and one HTTP port open. I started the enumeration with HTTP.
Port 80: HTTP
The webpage above is displayed for this web application.
This search page is interesting as it is dynamic. I can search for people. Testing the payload for ' OR IF (1=1, sleep(3), 'false') -- // worked and it seems the target is vulnerable to out-of-band SQL injection. Time to test for in-band SQL injections.
Testing mary' OR 1=1 -- // works as all the entries in the table gets output. Time to test the number of columns. It looks like the number of columns six is perfect. Anything more and nothing gets output.
I found the payload search=mary'+union+select+null+,+null+,+null+,+null+,+null+,+null+--+// works as a new set of rows are added with null data.
After sending the payload search=mary'+union+select+database()+,+@@version+,+null+,+null+,+null+,+null+--+//, I have more information about the backend application. The target host seems to be running MariaDB 10.3.17 and the current database being used is Staff.
There is another table called Users with three columns: UserID, Username, and Password. I identified this by using the payload '+union+select+table_name+,+column_name+,+table_schema+,+null+,+null+,+null+from+information_schema.columns+where+table_schema=database()--+//. Time to obtain the password of the user.
And boom! I now have the user called admin with the hash password of 856f5de590ef37314e7c3bdf6f8a66dc.
Running the password on crackstation shows the password is transorbital1. Now I have the credential admin:transorbital1. I should be able to login to the web-application now as the admin user!
And now I have access to the web-application as the user admin. The footer seems to be missing the file, as the message File does not exist is displayed. Maybe I can perform LFI?
When testing for the parameter of the footer, I found file works! Using the payload http://192.168.155.209/manage.php?file=../../../../../etc/passwd, I included the /etc/passwd file. Now I have the cookie of admin, I can use this to enumerate further using ffuf and the -b flag.
I used the command ffuf -w /usr/share/wordlists/seclists/Fuzzing/LFI/LFI-Jhaddix.txt -u http://192.168.155.209/manage.php?file=../../../../../../../../../FUZZ -fs 1341 -b 'PHPSESSID=49pduksq6sshl1sf44th3i2fvr' to enumerate for any interesting files on the target machine that I could poison. I did not find anything useful other than the knockd.conf file. The SSH port is filtered, but viewing this file did not open the SSH port. However, doing an aggressive nmap scan with the -r flag opened it.
There are eighteen users on the target machine according to the /etc/passwd file. I copied all the names of these users so that I could password-spray transorbital1 using SSH. The usernames are shown above. However, spraying this password did not work. Time to enumerate harder.
I had all the usernames, but I wanted to find out if the web-application had the passwords. Then using the payload '+union+select+id+,+firstname+,+lastname+,+password+,+null+,+null+from+users.UserDetails+--+//, I found out they do in a table called UserDetails inside users.
I obtained all the usernames and passwords and saved them to a file. Now I can spray them again against the SSH application.
And this time it worked! I gained three successful logins, as shown above.
Exploitation
The user janitor is different compared to the other two. I gained access to the target machine using this user's details. Now I have a foothold on the target machine.
Privilege Escalation
This user has an interesting file called passwords-found-on-post-it-notes.txt. This file contains the passwords above.
I generated the combination of all usernames and the new possible passwords. And I managed to find the login for the user fredf with the password B4-Tru3-001.
And I elevated my privileges to the user fredf with the new password. It looks like this user can run the binary above.
I found the source-code of this application too. Basically it requries two files, and the program outputs the content of file1 to the file2. What if I append a new user with root privileges to the /etc/hosts file?
I created the new root user super with the password root. And I used the binary to write the content with the new user to the /etc/passwd file.
After switching to the new root user, I have a root shell.
Flags
The local.txt flag once I switched to the user fredf.
The root.txt flag.